# Share a website with someone (and their AI agent)

Site sharing lets another person, and the AI agent they use, run one domain's
website for you without getting your account. Typical case: you manage a
partner's or client's WordPress site through your own agent, and sometimes
you want them to make their own changes with theirs.

It works for Cloud for WordPress, Secure Static Hosting and Link in Bio.

## What the other person can and can't do

They get a new key with the `site` permission, limited to that one domain.

- **Can:** edit the WordPress site (`/hosting/createWpCredentials` gives
  WordPress REST API access), upload and delete static files, edit the Link in
  Bio page, take and restore backups, use a staging copy, change PHP and
  WordPress versions, SSL and search visibility.
- **Can't:** buy anything, cancel the hosting or change auto-renew, change DNS,
  turn on a Link in Bio page, reach any other domain, or see anything
  account-wide (balance, invoices, the domain list). Those calls return
  `INSUFFICIENT_SCOPE` or `DOMAIN_NOT_ALLOWED` and change nothing.

## 1. Ask (your agent)

```
POST /api/json/v3/apikey/share
{"apikey": "...", "secretapikey": "...",
 "domain": "example.com", "sharedWith": "Sarah"}
```

MCP: `share_site_access`. Optional `claimHours` (1 to 168, default 24) is how
long the link works once approved.

**Nothing is shared yet.** The response has an `approveUrl`. An agent can ask
to share, but only the account holder can approve it, so give them the link.

## 2. Approve (you, on porkbun.com)

The approval page shows the domain, who it is for, and exactly what they will
be able to do. Approving (after the usual re-verify) shows:

- a **share link** and a **QR code** of it,
- a **share code** like `ABCD-2345`,
- a **handoff prompt** to paste into the other person's AI agent.

Your agent can fetch the same bundle afterwards with `GET /apikey/shares`
(MCP: `list_site_shares`).

If API access is off for the domain, the page offers to turn it on; their
agent needs it.

## 3. Connect (them)

The link works **once**. Opening it shows what was shared and how to connect;
opening it doesn't claim anything.

- **Claude app or ChatGPT:** add the Porkbun connector
  (`https://mcp.porkbun.com/mcp`), choose Connect, then "I have a share code"
  on the Porkbun page and enter the code. No Porkbun account needed.
- **Any other agent:** paste the handoff prompt. The agent claims a key:

```
POST /api/json/v3/apikey/claim
{"shareToken": "<the token from the link>"}
```

No API key is needed for this call. It returns `apikey` and `secretapikey`
once; the secret is never shown again. The agent then starts with
`GET /hosting/get/example.com`.

## 4. Stay in control

- You get an email when the share is claimed, with where it came from.
- The access shows as the key **"Share: Sarah"** in
  [API Access](https://porkbun.com/account/api). Its permissions can't be
  edited; delete it to end their access.
- Or revoke from your agent: `POST /apikey/revokeShare` with the share `id`
  (MCP: `revoke_site_share`). Unclaimed links stop working; a claimed key stops
  within seconds.

## Errors

- `SHARE_NOT_FOUND`: the link or code was already used, revoked, expired or
  mistyped. Ask for a new one.
- `HOSTING_NOT_FOUND`: the domain has no hosting or Link in Bio page to share.
- `INSUFFICIENT_SCOPE`: on `/apikey/share`, the key needs full access or the
  `account` permission, and a key that was itself shared can't share onward.
  For the person it was shared with, the call is outside what `site` allows.
- `DOMAIN_NOT_ALLOWED`: the call named a domain other than the shared one.

Sandbox keys can't share: hosting doesn't exist in the sandbox.


---

## More

- Guides (how-tos): https://porkbun.com/llms/guides
- Help articles (knowledge base) as Markdown: https://porkbun.com/llms/kb
- Topic index: https://porkbun.com/llms
- Full reference (one file): https://porkbun.com/llms-full.txt
- OpenAPI spec (full schemas): https://porkbun.com/api/json/v3/spec
- Short overview: https://porkbun.com/llms.txt
- Official MCP server: https://porkbun.com/mcp (`npx -y @porkbunllc/mcp-server`)
- Create API keys: https://porkbun.com/account/api